Messages

Upgraded to 25.1.7_4 and checked out Kea DHCP operation, my laptop can obtain an IPv6 address however if fails to get an IPv4 address.
Checking KEA's information logs 

Code Select Expand

2025-05-24T13:02:39 Informational kea-dhcp4 INFO [kea-dhcp4.packets.0x2b0007816d00] DHCP4_PACKET_SEND [hwtype=1 ab:ab:ab:ab:ab:ab], cid=[01:ab:ab:ab:ab:ab:ab], tid=0x4ae8d6a: trying to send packet DHCPOFFER (type 2) from 192.168.1.1:67 to 192.168.1.10:68 on interface lagg0_vlan2
2025-05-24T13:02:39 Informational kea-dhcp4 INFO [kea-dhcp4.leases.0x2b0007816d00] DHCP4_LEASE_OFFER [hwtype=1 ab:ab:ab:ab:ab:ab], cid=[01:ab:ab:ab:ab:ab:ab], tid=0x4ae8d6a: lease 192.168.1.10 will be offered
2025-05-24T13:02:39 Informational kea-dhcp4 INFO [kea-dhcp4.packets.0x2b0007816d00] DHCP4_PACKET_RECEIVED [hwtype=1 ab:ab:ab:ab:ab:ab], cid=[01:ab:ab:ab:ab:ab:ab], tid=0x4ae8d6a: DHCPDISCOVER (type 1) received from 0.0.0.0 to 255.255.255.255 on interface lagg0_vlan2
2025-05-24T13:02:39 Informational kea-dhcp4 INFO [kea-dhcp4.dhcp4.0x2b0007816d00] DHCP4_QUERY_LABEL received query: [hwtype=1 ab:ab:ab:ab:ab:ab], cid=[01:ab:ab:ab:ab:ab:ab], tid=0x4ae8d6a
So the logs are indicating its trying to send an DHCPOFFER and my laptop does not receive the offer, given that ISC DHCP works and the network has not changed. Would there be an issue with the automated Firewall rules.

The other thing I have noticed with Kea, is that DHCPv6 leases which have exceeded their expiry date are still being displayed.

Tried 25.1.7_2 with Kea DHCPv6 and DHCPv4 and now even from a reboot while my laptop does get an IPv6 address it fails to get an IPv4 address, looking at the Kea DHCPv4 information logs only the DO portion of the DORA process completes. Like before my daughter's laptop did not obtain an IP address (IPv4 or IPv6).

After checking the KEA Logs (informational) with 25.1.6_4, after a power cycle the logs show my laptop communicating with KEA and obtaining an IPv6 address then after a brief period it shows the laptop going through the DORA process and obtaining IPv4 address. After restarting the KEA Service and power cycling the laptop, the logs show an IPv6 address SARR process, however the IPv4 only completes DO or DORA, an DHCPOFFER is sent but there is never any response.
In respect of my daughter's connection, I connected a laptop to her network connection and could not get an IPv6 or IPv4 address checking the logs it shows that for IPv6 it completes SA of SARR and DO or DORA. In both cases I am using automated firewall rules, checking them manually they appear to be correct.
Both VLANs are connected to LAG interface connecting the 25.1.6_4 to my switch.
Restoring the ISC DHCP backup and with the attendant reboot, everything works as normal. So it is not a network issue, it appears to be directly related to ISC Kea.

I have have two VLANs configured to seperate work traffic (myself and daughter) from home traffic. Currently I did have ISC DHCPv4 and DHCPv6 configured to supply both IPv4 and IPv6 traffic to work devices. After upgrading to 25.1.6_2 I performed a backup and then disabled ISC DHCPv4 and DHCPv6 and configured the same networks onto Kea DHCPv4 and DHCPv6. Initially with 25.1.6_2 I did managed to get an IPv4 and IPv6 address on my laptop but the lease did not appear. However after a power cycle the my laptop obtained an IPv4 and IPv6 address with both the IPv4 and IPv6 lease appearing; my daughter's laptop never obtained an IP address.
After upgrading to 25.1.6_4 I am able to obtain an IPv6 address but unable to obtain an IPv4 address, reverting to using ISC DHCP by restoring a backup IP addresses are always obtained.
If I power cycle 25.1.6_4 using the Kea backup, then my laptop does get IPv6 address immediately and then will get an IPv4 address, however only the IPv6 lease appears in Leases DHCPv6, nothing appears in Leases DHCPv4. If I restart the Kea DHCP service then I stop getting an IPv4 address and only obtain an IPv6 address

I have been running a pair of ISC Kea DHCPv4 and DHCPv6 servers on linux for over two years since ISC stopped maintaining ISC DHCP at the end of 2022. Personally very happy to switch because of the ISC Kea ability to handle DHCP Failover for DHCPv6 which was not supported in ISC DHCP.

Is it possible to modify or update to a later version the resource which is referenced by ARP table so that I can add missing Vendor mac prefix entries. Using maclookup.app I found that the 74:78:27 was assigned to Dell on 23rd September 2020, so it is not new being nearly three years old. Which raises the question how frequently the vendor mac prefix resource is updated.

Hi,
What I have found is that if a Router Advertisement includes a Network Prefix and an IPv6 client is configured with a static address, unless you configure the client to not accept router advertisements then the client will generate a SLAAC address if the Router Advertisement includes a network prefix.

The use of a network prefix is to inform the client to generate to either generate a SLAAC address or inform the client to use DHCPv6 stateful or stateless.

I found with Windows 2008 server configured with a static address, using RA I could get it to generate a SLAAC address. This was fixed in if I remember correctly in Server 2012 so it ignored the RA by default.

Hi

Great that you can disable autoconfiguration on your version of Windows 10.
Which version of Windows 10 are you testing? My wife's laptop Windows 10 will not disable Autoconfiguration.

Either way the Network Prefix should not be included in the Router Advertisement when Managed is selected and the DHCPv6 server on Opnsense is disabled.

The problem is that Autoconfiguration is enabled by default, on Linux it is easy to permanently disable acting on Router Advertisements but on Windows it is more problematic and all a rogue actor needs to do is to inject rogue router advertisements into an IPv6 network to cause havoc.

Hi

On Windows 10 the command which is supposed to disable autoconfiguration does not work

netsh interface ipv6 set interface "Local Area Connection" routerdiscovery=disabled

there is additional option which is supposed to take effect immediately or permanently and they do not work.

There is no reason for the Network Prefix to be included in the Router Advertisement when in router or managed mode.

As a result of the Router Advertisements ICMPv6 Option 134 including the Network Prefix is in Managed Mode this is causing Windows 10 clients which have been configured with Static IPv6 Addresses to generate SLAAC addresses.
Windows Auto Address configuration is enabled is enabled by default, and despite searching with Google I have not found a way to disable IPv6 auto address configuration when using static IPv6 addresses.

Configuring Router Advertisements to "Managed" I know does not disable Router Advertisements but the Router Advertisement should not include ICMP Option (Prefix Information) as this includes Valid Lifetime and Preferred Lifetime settings and is used by clients to generate SLAAC addresses.

ICMP Option (Prefix Information) should only be included when Router Advertisements are configured "Unmanaged", "Assisted" and "Stateless" when SLAAC is being used.

Further to the packet capture, expanding the ICMPv6 Option (Prefix information) it includes a Valid Lifetime and Preferred Lifetime information which is being used to get the DHCPv6 clients to generate a SLAAC address using the information.

When the Router Advertisements are set to Managed, SLAAC is disabled and the ICMPv6 Option (Prefix Information) should be advertised. The DHCPv6 Server should handle the allocation of IPv6 Addresses.

Hi,

I have my Opnsense 23.1.5_4 configured for IPv6 Router Advertisements as Managed, as I have separate pair of Kea Servers handling IPv6. I noticed that a Windows 10 PC was using SLAAC to automatically generate its own IP address.

When I performed a packet capture I found that the SLAAC Router Advertisements were coming from the Opnsense which I specifically had disabled by configuring as Managed.

I presume this is a bug.

I have updated to include the packet capture despite the Router Flags set to Managed and the Opnsense dhcp server being disabled it includes the Network Prefix to cause clients to generate their own SLAAC address

Hi,

Would it be possible for the System Packet information after selecting an interface, the packet graphs would split IPv4 so it displays IPv4 vertically above the line and IPv6 below the line to the same scale. So visually it is easy to compare IPv4 and IPv6 traffic volume.